Privacy Policy

1. Who We Are

The Faith & Fitness Rally Lagos event and this registration platform are operated by TomNash Fitness Hub (Registered Business No. 9578101), referred to as “we,” “our,” or “us.” This Privacy Policy explains how we collect, use, and protect your personal information in accordance with the Nigeria Data Protection Regulation (NDPR) and applicable data protection law.

2. Information We Collect

We collect the following personal information when you register for the event:

• Full name
• Email address
• Phone number
• Gender and age range (optional)
• Emergency contact (optional)
• Fitness level (optional)
• Medical notes relevant to participation (optional)
• Payment reference and transaction status (no card data is stored)
• Registration timestamp and IP address

If you submit a sponsorship enquiry, we collect your organization name, contact name, email, and phone number.

If you use our pre-launch notification form, we collect your email address and WhatsApp number.

3. How We Use Your Information

We use your personal information to:

• Process your event registration and payment
• Send you a registration confirmation email
• Provide your registration code for event check-in
• Send event-related communication (reminders, updates)
• Manage event operations and attendee welfare
• Respond to enquiries and provide support
• Comply with legal and regulatory obligations

4. Lawful Basis for Processing

We process your personal data on the following lawful bases:

• Contract: To process your registration and fulfill the event agreement.
• Consent: For optional communications and marketing (which you may withdraw at any time).
• Legitimate Interests: For event security, safety, and fraud prevention.
• Legal Obligation: Where required by Nigerian law.

5. Data Sharing

We do not sell your personal information. We may share your data with:

• Paystack: Our payment processor, who handles payment transactions securely. Their privacy policy governs their data handling.
• Email service providers: To send transactional emails on our behalf.
• Event staff: Limited to the information necessary for event operations (check-in staff have restricted access).

We will not share your data with third parties for marketing purposes without your explicit consent.

6. Data Retention

[PENDING: Retention policy to be confirmed by organizer and legal counsel.]

As a general principle, registration and payment records are retained for at least 7 years for accounting and audit purposes. Lead capture records and marketing data are retained for the duration of the marketing campaign and then deleted or anonymized.

7. Your Rights

Under the Nigeria Data Protection Regulation (NDPR), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal obligations)
• Object to or restrict processing
• Data portability
• Withdraw consent at any time where consent is the lawful basis

To exercise your rights, contact us at: [PENDING: contact email]

8. Security

We implement appropriate technical and organizational security measures to protect your personal data, including encrypted connections (HTTPS), hashed passwords, and restricted staff access to sensitive fields. Payment processing is handled entirely by our payment gateway provider; we do not store card details.

9. Cookies

[PENDING: Cookie policy to be confirmed.] This platform uses session cookies necessary for secure login and CSRF protection. We do not use tracking or advertising cookies without consent.

10. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact:

11. Selfie Frame Generator

When you use the Selfie Frame Generator, your uploaded photo is processed locally in your browser to generate your downloadable event image. We do not store your uploaded photo on our server unless a future feature clearly asks for your consent. We may record anonymous usage events such as frame generation, download clicks, and registration clicks to improve the campaign experience. These analytics events do not contain your photo or any directly identifiable personal information.